The affected domain's DNS record points to the correct target and ownership is verified, so nothing in your DNS needs to change. The certificate request was refused because Let's Encrypt is rate-limiting certificates for that name after repeated attempts.

Waiting for that rate-limit window to clear is the only fix. Any new attempt made before it clears will fail the same way.

What is the expected wait time for the rate-limit windows to clear?

Let's Encrypt sets these windows on their side, and the refusal we received for this name did not include a time when it clears, so we can't give you an exact time. The certificate for that domain is still showing the same rate-limit failure as of now. Let's Encrypt publishes how long each of its limits lasts on their rate limits page.